What is attack surface management?
Short answer: Attack surface management (ASM) is discovering and tracking what is exposed outside (IPs, applications, cloud, pre-production) so an attacker does not find it before you do.
Definition
The external attack surface is what an adversary can see and reach without internal credentials: published services, cloud misconfiguration, test systems, leaked credentials. Managing it means keeping that map current and prioritising what is exploitable. It is not an ITAM inventory of the internal estate, and it is not by itself a deep audit of one application.
Why it matters
Cloud, APIs and shadow IT change exposure between one pentest and the next. An annual report describes a moment; the attacker does not wait for that date.
Without an external map, the team defends the perimeter it thinks it has, not the one that is actually published.
What it is not
It is not ITAM. Internal inventory answers what exists behind the firewall. ASM answers what is visible from the internet.
It is not only an application pentest. A deep test of one system validates a different kind of risk. They can complement each other; they are not synonyms.
In the Azuba model
Offensive Security & Exposure Management treats attack surface and continuous pentesting as capabilities distinct from application validation.
In Offensive Security & Exposure Management, FireCompass covers the attack surface and, on that map, pentesting with AI agents.
Continue
Does ASM replace a pentest?
No. ASM keeps the map of what is exposed. A pentest (point-in-time or continuous) checks whether a path is exploitable. A surface finding without validation is a hypothesis.
Is attack surface the same as the IT inventory?
No. Inventory describes the estate, often internal. Surface describes what a stranger can reach. They can overlap on a published asset; they are not the same record.